Previous: , Up: ESPER  


ESPER PCAP mode

There is ability not to start listening real-time traffic processing daemon, but to read packets from PCAP file fed into stdin, process them and write results to PCAP on stdout. PCAP is expected to contain Ethernet packets only. You should use redo esper-pcap build target for build with PCAP support (github.com/google/gopacket dependency required).

Enable that mode with -pcap option and place SA/SP configuration commands to -cmd file. That file is not expected to be UNIX-socket in that mode, just plaintext file with CR/CRLF-terminated lines, with possible ^# comments and empty lines. Fed inbound PCAP file to stdin, catch outbound PCAP from stdout. For example:

$ cat > cmds <<EOF
add fc00::dc fc00::ac esp 0x12345679 -u 234 -E aes-gcm-16 0x9a2dae68e475eacb39d41f23c3cbef890e9f6276 ;
spdadd fc00::dc/128 fc00::ac/128 any -P out ipsec esp/transport//unique:234 ;
EOF
$ ./esper -pcap -cmd cmds < inbound.pcap > outbound.pcap